Forgeries contest - sk8erboy's results

A protocol for on-chain games with NFT prizes on Ethereum.

General Information

Platform: Code4rena

Start Date: 13/12/2022

Pot Size: $36,500 USDC

Total HM: 5

Participants: 77

Period: 3 days

Judge: gzeon

Total Solo HM: 1

Id: 191

League: ETH

Forgeries

Findings Distribution

Researcher Performance

Rank: 77/77

Findings: 1

Award: $19.22

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

19.2206 USDC - $19.22

Labels

bug
3 (High Risk)
satisfactory
upgraded by judge
duplicate-146

External Links

Lines of code

https://github.com/code-423n4/2022-12-forgeries/blob/fc271cf20c05ce857d967728edfb368c58881d85/src/VRFNFTRandomDraw.sol#L306

Vulnerability details

Impact

If the admin calls redraw(), it is possible that the randomness will be delivered after the recovery timelock unlocks. Therefore, the winner may not have enough time to claim the NFT, or the randomness can be delivered already after the NFT has been recovered.

Proof of Concept

None needed

Tools Used

Manual review

Ensure that the recovery timelock takes into account the latest draw and allow the waiting period to elapse before the NFT can be recovered. Similarly, ensure that if the contract is waiting for fulfilling randomness, the NFT cannot be recovered in between.

#0 - c4-judge

2022-12-17T16:30:54Z

gzeon-c4 marked the issue as duplicate of #146

#1 - c4-judge

2023-01-23T16:53:18Z

gzeon-c4 marked the issue as satisfactory

#2 - c4-judge

2023-01-23T17:09:41Z

gzeon-c4 changed the severity to 3 (High Risk)

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter